Key Takeaways
- • OneKey founder and CEO Yishi Wang warned that North Korean hackers could target BlackRock's iShares Bitcoin Trust (IBIT) next, following a $6.3 billion hack of Binance.
- • IBIT, the world's largest bitcoin ETF with roughly 815K BTC (nearly $63 billion), relies on Coinbase as its sole custodian, which Wang described as an extraordinary concentration of risk.
- • Unlike stablecoins, stolen bitcoin cannot be frozen by centralized issuers, and Coinbase's $320 million criminal insurance is shared across customers, with custody agreements capping liability at $100 million per cold storage address.
Summary
Yishi Wang, founder and CEO of Hong Kong-based open-source hardware wallet company OneKey, has suggested that BlackRock's iShares Bitcoin Trust (IBIT) could be the next target of North Korean hackers, according to a post on social media reported by Bitcoin News. The warning follows a $6.3 billion hack of Binance, the largest cryptocurrency exchange, which occurred on a Thursday and is still being absorbed by the industry.
According to Wang, IBIT, the largest bitcoin ETF, held 815,000 BTC, worth nearly $63 billion, making it an attractive target. The fund uses Coinbase as its sole custodian, a concentration Wang argued creates a single critical failure point. "Regardless of how large or well-funded that provider is, a critical failure in its security infrastructure could put the entire fund at risk," he said.
Wang estimated that an attack comparable to the Binance breach would wipe out 9.5% of IBIT's assets, producing losses that could be socialized at about $4 per share at current valuations. He noted that an attack on bitcoin differs from one on stablecoins: after the Binance hack, Circle and Tether collectively froze over $2.3 billion in stolen stablecoins, but stolen BTC cannot be blocked by centralized issuers.
On insurance, Coinbase has disclosed $320 million in criminal insurance coverage. Wang said this is shared across its customers, and custody agreements limit liability to $100 million per cold storage address, meaning IBIT holders would bear much of the loss in a major attack.
Wang concluded that while bitcoin ETFs offer convenience for institutions and individuals who do not want to self-custody, "the larger these pools become, the more attractive they are to attackers." He added, "There are no silver bullets in security, and no permanent guarantees," and referenced the "bunker mode" concept recently coined by blockchain researcher Justin Drake.
According to Wang, IBIT, the largest bitcoin ETF, held 815,000 BTC, worth nearly $63 billion, making it an attractive target. The fund uses Coinbase as its sole custodian, a concentration Wang argued creates a single critical failure point. "Regardless of how large or well-funded that provider is, a critical failure in its security infrastructure could put the entire fund at risk," he said.
Wang estimated that an attack comparable to the Binance breach would wipe out 9.5% of IBIT's assets, producing losses that could be socialized at about $4 per share at current valuations. He noted that an attack on bitcoin differs from one on stablecoins: after the Binance hack, Circle and Tether collectively froze over $2.3 billion in stolen stablecoins, but stolen BTC cannot be blocked by centralized issuers.
On insurance, Coinbase has disclosed $320 million in criminal insurance coverage. Wang said this is shared across its customers, and custody agreements limit liability to $100 million per cold storage address, meaning IBIT holders would bear much of the loss in a major attack.
Wang concluded that while bitcoin ETFs offer convenience for institutions and individuals who do not want to self-custody, "the larger these pools become, the more attractive they are to attackers." He added, "There are no silver bullets in security, and no permanent guarantees," and referenced the "bunker mode" concept recently coined by blockchain researcher Justin Drake.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.